hotdata 0.9.1__tar.gz → 0.10.0__tar.gz

{hotdata-0.9.1 → hotdata-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hotdata
-Version: 0.9.1
+Version: 0.10.0
 Summary: Hotdata API
 Author-email: Hotdata <developers@hotdata.dev>
 License: MIT

{hotdata-0.9.1 → hotdata-0.10.0}/hotdata/api_client.py

@@ -281,105 +281,12 @@ class ApiClient:
                 body=body, post_params=post_params,
                 _request_timeout=_request_timeout
             )
-            if response_data.status == 401:
-                # `header_params` is Optional on this method. `param_serialize`
-                # always passes a dict so nothing in-tree omits it, but a direct
-                # caller that does would otherwise crash HERE, on the failure
-                # path, rather than anywhere it could be noticed.
-                header_params = header_params if header_params is not None else {}
-                fresh = self._remint_bearer(header_params)
-                if fresh is not None:
-                    # Drain the response being discarded. urllib3 only returns a
-                    # connection to the pool once its body is consumed or
-                    # released; abandoning it un-read leaks the connection for
-                    # the life of the pool, and a client that 401s on every
-                    # request would exhaust it.
-                    try:
-                        response_data.read()
-                    except Exception:  # noqa: BLE001 -- draining must not mask the retry
-                        pass
-                    header_params["Authorization"] = fresh
-                    response_data = self.rest_client.request(
-                        method, url,
-                        headers=header_params,
-                        body=body, post_params=post_params,
-                        _request_timeout=_request_timeout
-                    )
 
         except ApiException as e:
             raise e
 
         return response_data
 
-    def _remint_bearer(self, header_params):
-        """A replacement `Authorization` value after a 401, or None to give up.
-
-        ONCE per request, and only for a bearer this client minted. A 401 on an
-        exchanged JWT is recoverable in a way it is not for a caller-supplied
-        credential: the SDK swapped an API token for a short-lived JWT behind the
-        caller's back, so a JWT the server refuses is the SDK's problem to fix,
-        not an error the caller can act on.
-
-        The proactive `_exp` check covers the expected case. This covers the one
-        it cannot: a token the client still believed in but the server rejected —
-        clock skew, a revoked JWT, or a mint that reported a lifetime the token
-        did not have. Returns None when there is nothing to re-mint (no manager,
-        a caller-supplied JWT, exchange opted out) so the 401 surfaces unchanged.
-
-        Never loops. A second 401 is a real rejection and is returned to the
-        caller; retrying a genuine auth failure would only turn one clear error
-        into a slower one.
-        """
-        from hotdata._auth import TokenExchangeError
-
-        config = self.configuration
-        manager = getattr(config, "_token_manager", None)
-        if manager is None or not getattr(manager, "_needs_exchange", False):
-            return None
-
-        # Only a header THIS manager produced. `_request_auth` lets a caller
-        # override auth for a single request, and a per-request credential that
-        # the server rejects is the caller's to deal with -- replacing it with a
-        # managed token would silently answer a different question than the one
-        # asked, and would do it only on the failure path where it is hardest to
-        # notice.
-        stale = manager._jwt
-        before = header_params.get("Authorization")
-        if stale is not None and before == "Bearer " + stale:
-            # We carried the token the manager still holds: clear it so the read
-            # below mints. Compare-and-clear, so a thread that is beaten to it
-            # takes the winner's token rather than clearing it again.
-            manager.invalidate(only_if=stale)
-        elif before == "Bearer " + (manager._prev_jwt or "\0"):
-            # We carried the token the manager has ALREADY rotated away from --
-            # another request 401'd on it first and minted the replacement. Do
-            # not invalidate: retry with what it minted. Without this the winner
-            # recovers and every sibling fails, since their header no longer
-            # matches the current token, which is the stampede case the
-            # compare-and-clear was added for in the first place.
-            pass
-        else:
-            # A credential this manager never issued -- `_request_auth`, or an
-            # endpoint with no auth at all. Not ours to replace.
-            return None
-        try:
-            token = config.api_key
-        except TokenExchangeError:
-            # The commonest cause of a 401 is a revoked or expired API token, and
-            # re-minting from it fails for the same reason. `invalidate` cleared
-            # the refresh token, so this raise has no best-effort path behind it.
-            # Surfacing it here would replace the server's own 401 -- body and
-            # all -- with an exchange error from a retry the caller never asked
-            # for, turning a clear answer into a confusing one.
-            return None
-        if token is None:
-            return None
-        after = "Bearer " + token
-        # A re-mint that hands back the same credential means the server would
-        # refuse it again; sending it a second time buys a round trip and the
-        # same 401. This is the replayed-cache case, so it is not hypothetical.
-        return None if after == before else after
-
     def response_deserialize(
         self,
         response_data: rest.RESTResponse,

{hotdata-0.9.1 → hotdata-0.10.0}/hotdata/configuration.py

@@ -220,13 +220,8 @@ conf = hotdata.Configuration(
         self.temp_folder_path = None
         """Temp file folder for downloading files
         """
-        # Transparent API-token -> JWT exchange. `api_key` is a property whose
-        # getter returns a live JWT minted from this credential (see _auth.py);
-        # the manager is created eagerly here (never lazily in the getter) so
-        # concurrent first requests don't each build one. The setter rebuilds it.
-        from hotdata._auth import _TokenManager
-        self._token_manager = _TokenManager(api_key, self) if api_key is not None else None
-        """Hotdata API key, sent as `Authorization: Bearer <key>`."""
+        self.api_key = api_key
+        """Hotdata API key, sent verbatim as `Authorization: Bearer <key>`."""
         # apiKey-security values (X-Workspace-Id), keyed by scheme name. Read by
         # the generated `auth_settings()` below.
         self.api_keys = dict(api_keys) if api_keys else {}
@@ -343,20 +338,13 @@ conf = hotdata.Configuration(
         result = cls.__new__(cls)
         memo[id(self)] = result
         for k, v in self.__dict__.items():
-            # _token_manager holds a threading.Lock and a urllib3 PoolManager,
-            # neither of which is deepcopy-able; rebuild it below from the
-            # (deepcopy-safe) credential string instead.
-            if k not in ('logger', 'logger_file_handler', '_token_manager'):
+            if k not in ('logger', 'logger_file_handler'):
                 setattr(result, k, copy.deepcopy(v, memo))
         # shallow copy of loggers
         result.logger = copy.copy(self.logger)
         # use setters to configure loggers
         result.logger_file = self.logger_file
         result.debug = self.debug
-        # rebuild the token manager bound to the copy (never deepcopy lock/pool)
-        from hotdata._auth import _TokenManager
-        tm = self._token_manager
-        result._token_manager = _TokenManager(tm._credential, result) if tm else None
         return result
 
     def __setattr__(self, name: str, value: Any) -> None:
@@ -501,26 +489,6 @@ conf = hotdata.Configuration(
 
         return None
 
-    @property
-    def api_key(self) -> Optional[str]:
-        """Live bearer credential, sent as `Authorization: Bearer <value>`.
-
-        Backed by the regeneration-immune `_TokenManager` (see `hotdata._auth`):
-        an opaque API token is transparently exchanged for a short-lived JWT and
-        kept fresh, while a credential already shaped like a JWT (or exchange
-        opted out) is returned unchanged. `auth_settings()` reads this on every
-        request, so the wire always carries a current token.
-        """
-        # Read the manager once: a concurrent `api_key` reset could otherwise
-        # set it to None between the check and the `.bearer_value()` call.
-        tm = self._token_manager
-        return None if tm is None else tm.bearer_value()
-
-    @api_key.setter
-    def api_key(self, value: Optional[str]) -> None:
-        from hotdata._auth import _TokenManager
-        self._token_manager = _TokenManager(value, self) if value is not None else None
-
     @property
     def workspace_id(self) -> Optional[str]:
         """Public id of the target workspace (sent as `X-Workspace-Id`)."""
@@ -555,9 +523,8 @@ conf = hotdata.Configuration(
         :return: The Auth Settings information dict.
         """
         auth: AuthSettings = {}
-        # Resolve the bearer token once: `api_key` is a property that may mint a
-        # JWT and take the token-manager lock, so a second read would lock twice
-        # and could race a concurrent `api_key` reset (yielding `Bearer None`).
+        # Read the credential once so a concurrent `api_key` reset can't yield
+        # `Bearer None` between the check and the header build.
         BearerAuth_token = self.api_key
         if BearerAuth_token is not None:
             auth['BearerAuth'] = {

{hotdata-0.9.1 → hotdata-0.10.0}/hotdata.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hotdata
-Version: 0.9.1
+Version: 0.10.0
 Summary: Hotdata API
 Author-email: Hotdata <developers@hotdata.dev>
 License: MIT

{hotdata-0.9.1 → hotdata-0.10.0}/hotdata.egg-info/SOURCES.txt

@@ -2,7 +2,6 @@ README.md
 pyproject.toml
 setup.cfg
 hotdata/__init__.py
-hotdata/_auth.py
 hotdata/_retry.py
 hotdata/_upload_watchdog.py
 hotdata/api_client.py
@@ -310,8 +309,8 @@ test/test_workspace_detail.py
 test/test_workspace_list_item.py
 test/test_workspace_usage_response.py
 test/test_workspaces_api.py
+tests/test_api_token_auth.py
 tests/test_arrow.py
-tests/test_auth.py
 tests/test_config_auth_surface.py
 tests/test_query.py
 tests/test_retry.py

{hotdata-0.9.1 → hotdata-0.10.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "hotdata"
-version = "0.9.1"
+version = "0.10.0"
 description = "Hotdata API"
 authors = [
   {name = "Hotdata",email = "developers@hotdata.dev"},

hotdata-0.10.0/tests/test_api_token_auth.py

@@ -0,0 +1,156 @@
+"""The API token is the only credential: it goes on the wire verbatim.
+
+Hotdata deprecated the API-token -> JWT key exchange. The SDK used to hold a
+hand-written `_TokenManager` (`hotdata/_auth.py`) that POSTed the configured
+token to `/v1/auth/jwt`, cached the returned JWT, and refreshed it with a
+`refresh_token` grant; `Configuration.api_key` was a property that minted on
+every read. All of that is gone -- the configured token is sent as
+`Authorization: Bearer <token>` unchanged.
+
+These tests pin that end to end: the token reaches the wire as-is, no token
+endpoint is ever contacted, and the exchange machinery cannot creep back in via
+the generated `configuration.py` or its mustache template.
+"""
+
+from __future__ import annotations
+
+import copy
+import importlib
+from pathlib import Path
+
+import pytest
+import urllib3
+
+from hotdata import ApiClient, Configuration
+from hotdata.api.workspaces_api import WorkspacesApi
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+CONFIGURATION_TEMPLATE = REPO_ROOT / ".openapi-generator-templates" / "configuration.mustache"
+CONFIGURATION_MODULE = REPO_ROOT / "hotdata" / "configuration.py"
+
+# An opaque (non-JWT-shaped) token: exactly the credential the old exchange
+# would have swapped for a JWT before sending.
+API_TOKEN = "hd_opaque_api_token"
+
+
+def _config(**kwargs) -> Configuration:
+    return Configuration(host="https://api.example.test", api_key=API_TOKEN, **kwargs)
+
+
+def _no_network(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Make any outbound urllib3 request an immediate failure.
+
+    The exchange built its own pool manager, so a surviving mint would show up
+    here rather than as a silently different header.
+    """
+
+    def explode(*args, **kwargs):  # pragma: no cover - only runs on regression
+        raise AssertionError(f"unexpected outbound request: {args!r} {kwargs!r}")
+
+    monkeypatch.setattr(urllib3.PoolManager, "request", explode)
+    monkeypatch.setattr(urllib3.PoolManager, "urlopen", explode)
+
+
+def test_api_token_is_sent_verbatim_as_bearer(monkeypatch: pytest.MonkeyPatch) -> None:
+    """The configured token itself is the bearer credential."""
+    _no_network(monkeypatch)
+    config = _config()
+
+    assert config.auth_settings()["BearerAuth"]["value"] == f"Bearer {API_TOKEN}"
+
+
+def test_authorization_header_carries_the_api_token(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Serializing a real operation puts the raw token in the header."""
+    _no_network(monkeypatch)
+    api = WorkspacesApi(ApiClient(_config(workspace_id="ws_abc")))
+
+    _method, _url, headers, *_rest = api._list_workspaces_serialize(
+        organization_public_id=None,
+        _request_auth=None,
+        _content_type=None,
+        _headers=None,
+        _host_index=0,
+    )
+
+    assert headers["Authorization"] == f"Bearer {API_TOKEN}"
+
+
+def test_api_token_is_read_repeatedly_without_exchange(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Every request re-reads the credential; none of those reads mint anything."""
+    _no_network(monkeypatch)
+    config = _config()
+
+    values = {config.auth_settings()["BearerAuth"]["value"] for _ in range(5)}
+
+    assert values == {f"Bearer {API_TOKEN}"}
+
+
+def test_api_token_can_be_replaced_and_cleared(monkeypatch: pytest.MonkeyPatch) -> None:
+    """`api_key` stays writable, and clearing it drops the bearer header."""
+    _no_network(monkeypatch)
+    config = _config()
+
+    config.api_key = "hd_rotated"
+    assert config.auth_settings()["BearerAuth"]["value"] == "Bearer hd_rotated"
+
+    config.api_key = None
+    assert "BearerAuth" not in config.auth_settings()
+
+
+def test_deepcopy_preserves_the_api_token(monkeypatch: pytest.MonkeyPatch) -> None:
+    """`ApiClient` deepcopies the configuration; the credential must survive it.
+
+    The exchange needed a `__deepcopy__` special case because the token manager
+    held a lock and a pool manager. A plain string needs none, but the copy must
+    still authenticate.
+    """
+    _no_network(monkeypatch)
+    config = _config(workspace_id="ws_abc")
+
+    clone = copy.deepcopy(config)
+
+    assert clone.api_key == API_TOKEN
+    assert clone.auth_settings()["BearerAuth"]["value"] == f"Bearer {API_TOKEN}"
+
+
+def test_jwt_opt_out_env_var_is_inert(monkeypatch: pytest.MonkeyPatch) -> None:
+    """`HOTDATA_DISABLE_JWT_EXCHANGE` was the exchange escape hatch.
+
+    With no exchange left there is nothing to disable, so the variable must not
+    change behavior -- callers who still export it get the same raw token.
+    """
+    _no_network(monkeypatch)
+    monkeypatch.setenv("HOTDATA_DISABLE_JWT_EXCHANGE", "0")
+
+    assert _config().auth_settings()["BearerAuth"]["value"] == f"Bearer {API_TOKEN}"
+
+
+def test_auth_exchange_module_is_gone() -> None:
+    """`hotdata._auth` existed only to run the key exchange."""
+    with pytest.raises(ModuleNotFoundError):
+        importlib.import_module("hotdata._auth")
+
+
+def test_api_key_is_a_plain_attribute() -> None:
+    """A property getter is what made every read a potential mint."""
+    assert not isinstance(getattr(Configuration, "api_key", None), property)
+
+
+@pytest.mark.parametrize(
+    "path",
+    [CONFIGURATION_MODULE, CONFIGURATION_TEMPLATE],
+    ids=["generated", "template"],
+)
+def test_no_exchange_machinery_in_configuration(path: Path) -> None:
+    """Editing only the generated file would be undone by the next regen."""
+    source = path.read_text()
+
+    for needle in (
+        "_TokenManager",
+        "_token_manager",
+        "_auth import",
+        "/v1/auth/jwt",
+        "refresh_token",
+        "HOTDATA_DISABLE_JWT_EXCHANGE",
+    ):
+        assert needle not in source, f"{path.name} still references {needle}"

{hotdata-0.9.1 → hotdata-0.10.0}/tests/test_arrow.py

@@ -87,11 +87,6 @@ def _install_fake_response(
 ) -> None:
     """Replace RESTClientObject.request with a stub that records the call."""
 
-    # The api_key used here ("test-key") is a dummy, not a real token. Disable
-    # transparent JWT exchange so auth_settings() does not try to mint one
-    # against a non-existent endpoint when the (stubbed) request is built.
-    monkeypatch.setenv("HOTDATA_DISABLE_JWT_EXCHANGE", "1")
-
     from hotdata import rest
 
     def fake_request(

{hotdata-0.9.1 → hotdata-0.10.0}/tests/test_config_auth_surface.py

@@ -32,13 +32,11 @@ from hotdata.api.results_api import ResultsApi
 REPO_ROOT = Path(__file__).resolve().parents[1]
 CONFIGURATION_TEMPLATE = REPO_ROOT / ".openapi-generator-templates" / "configuration.mustache"
 
-# A JWT-shaped credential is returned as-is by _TokenManager, so no exchange
-# request is ever made from these tests.
-FAKE_JWT = "eyJfake.payload.signature"
+FAKE_API_TOKEN = "hd_fake_api_token"
 
 
 def _config(**kwargs) -> Configuration:
-    return Configuration(host="https://api.example.test", api_key=FAKE_JWT, **kwargs)
+    return Configuration(host="https://api.example.test", api_key=FAKE_API_TOKEN, **kwargs)
 
 
 def _typed_api_key_kwargs() -> list[str]: